davsclaus opened a new pull request, #26217: URL: https://github.com/apache/camel/pull/26217
## Backport of #26208 Cherry-pick of #26208 (commit `e6e5621639a1`) onto `camel-4.18.x`. **Original PR:** #26208 — CAMEL-24655: add regression test for case-insensitive Camel header filtering in the CoAP consumer **Original author:** @oscerd **Target branch:** `camel-4.18.x` ### Not a byte-identical cherry-pick One adaptation was needed: `CoAPTestSupport.PORT` is a plain `int` on this branch, not an `AvailablePortFinder.Port`, so the route builder uses `PORT` instead of `PORT.getPort()`. That single token is the only difference from the original — the test logic, the header variants and the assertions are unchanged. ### Why backport The test guards the CVE-2025-27636 class of bug: the CoAP consumer maps incoming URI query parameters into Exchange headers, and the `HeaderFilterStrategy` call is what stops a remote peer from setting `Camel*` internal headers. `camel-4.18.x` carries the same `CamelCoapResource#handleRequest` code, so the branch benefits from the same regression guard. This is a **test-only** change — no production code is modified. ### Verification - `mvn test -Dtest=CoAPHeaderInjectionTest` in `components/camel-coap` on this branch: **1 test, green**. - Confirmed the test is a real guard on this branch, not vacuous: with the `applyFilterToExternalHeaders` call removed from `CamelCoapResource`, it fails with `expected: <null> but was: <malicious>`. The production file was restored afterwards and is untouched in this PR. _Claude Code on behalf of @davsclaus_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
